daloRADIUS up to 1.3 mng-del.php cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in daloRADIUS up to 1.3. This affects an unknown part of the file mng-del.php. The manipulation results in cross site scripting. This vulnerability is reported as CVE-2022-23475. The attack can be launched remotely. No exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in daloRADIUS up to 1.3. It has been classified as problematic. Affected is an unknown code block of the file mng-del.php. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to account takeover in the mng-del.php file because of an unescaped variable reflected in the DOM on line 116. This issue has been addressed in commit `ec3b4a419e`. Users are advised to manually apply the commit in order to mitigate this issue. Users may also mitigate this issue with in two parts 1) The CSRF vulnerability can be mitigated by making the daloRadius session cookie to samesite=Lax or by the implimentation of a CSRF token in all forms. 2) The XSS vulnerability may be mitigated by escaping it or by introducing a Content-Security policy.

The weakness was disclosed 12/07/2022 as GHSA-c9xx-6mvw-9v84. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2022-23475 since 01/19/2022. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

By approaching the search of inurl:mng-del.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch ec3b4a419e20540cf28ce60e48998b893e3f1dea is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• daloRADIUS

Version

• 1.0
• 1.1
• 1.2
• 1.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion